Splunk Enterprise

Comparison of details

luckyman80
Path Finder

Hi Experts,

                        I wondered the best way of comparing the below data.  So I have a query which returns as so .

index=myindex sourcetype=mysourcetype host="myhost" |table process, tier, country

This returns a 100 or so processes their tier and country as expected.  There is only 4 countries  uk, usa, denmark and spain

It returns something like this 

process              tier              country

process1          roman         uk

process2          roman         usa

Process3         roman          Denmark

process4         anglo            uk

process5       anglo              usa

process6       anglo             Denmark

process7       anglo             spain

The roman tier should be present in each country . If Spain is missing as above how to I only show the missing entry for spain as the outlier ? This is basically for a rec purpose so we can see whats missing.

thanks in advance ! 

 

 

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| chart count by country tier
| where roman=0

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart count by country tier
| where roman=0
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...